PRD-11: Content Security Policy Headers

[PancheI]

Add a comprehensive CSP header to the dashboard with wasm-unsafe-eval for CGGMP24 WASM signing support.

Acceptance Criteria

• Every response from the app container includes a Content-Security-Policy header
• default-src 'none' is the base policy
• script-src includes 'wasm-unsafe-eval' but NOT 'unsafe-eval'
• frame-ancestors 'none' prevents iframe embedding
• object-src 'none' blocks plugin content
• WASM signing flow works without CSP errors
• Google Fonts load correctly
• API calls work (same-origin via Caddy or direct)
• Zero CSP violation errors in browser console during normal usage
• Permissions-Policy header disables camera, microphone, geolocation, payment APIs
• Static assets have cache headers

Tasks

• Create docker/nginx.conf with CSP headers
• Update docker/app.Dockerfile to copy nginx.conf
• Remove duplicate headers if PRD-10 (Caddy) is implemented first
• Test: dashboard loads, WASM signing, Google Fonts, API calls, iframe blocking
• Run CSP evaluator tool